ExpanseAggregateAttributionCI Deprecated

Deprecated. No available replacement. > Aggregate entries from ServiceNow CMDB into AttributionCI.

python · Cortex Xpanse by Palo Alto Networks (Deprecated)

Details

ID	`ExpanseAggregateAttributionCI`
Language	python
From Version	6.0.0
Docker Image	`demisto/python3:3.10.13.83255`

README

Aggregate entries from ServiceNow CMDB into AttributionCI

Script Data

Name	Description
Script Type	python3
Tags
Cortex XSOAR Version	6.0.0

Used In

This script is used in the following playbooks and scripts.

Expanse Attribution Subplaybook

Inputs

Argument Name	Description
input	Input list.
current	Current aggregation state.

Outputs

Path	Description	Type
Expanse.AttributionCI.name	Name of the CI	string
Expanse.AttributionCI.sys_id	ServiceNow Sys ID	string
Expanse.AttributionCI.sys_class_name	Class Name of the CI	string
Expanse.AttributionCI.asset_display_value	Name of the Asset	string
Expanse.AttributionCI.asset_link	Link to the asset	string
Expanse.AttributionCI.asset_value	ID of the asset	string

Source

ExpanseAggregateAttributionCI.py ExpanseAggregateAttributionCI_test.py ExpanseAggregateAttributionCI.yml

Download History Raw

import demistomock as demisto  # noqa

import ExpanseAggregateAttributionCI


INPUT = [
    {
        "Attributes": {
            "name": "server 1",
            "sys_id": "1234",
            "sys_class_name": "cmdb_ci",
            "asset": {
                "display_value": "server 1",
                "link": "https://servicenow.com/5678",
                "value": "5678"
            }
        }
    }
]

CURRENT = []

RESULT = [
    {
        "name": "server 1",
        "sys_id": "1234",
        "sys_class_name": "cmdb_ci",
        "asset_display_value": "server 1",
        "asset_link": "https://servicenow.com/5678",
        "asset_value": "5678"
    }
]


def test_aggregate_command():
    """
    Given:
        - previous list aggregated IPs
        - new data source with IP/sightings information
        - merged aggregated data with new information
        - list of internal ip networks
    When
        - merging new sightings to existing aggregated data
    Then
        - data is merged
        - expected output is returned
    """
    result = ExpanseAggregateAttributionCI.aggregate_command({
        'input': INPUT,
        'current': CURRENT,
    })

    assert result.outputs_prefix == "Expanse.AttributionCI"
    assert result.outputs_key_field == ["sys_id"]
    assert result.outputs == RESULT